Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug #14087] x509cert, x509crl, x509req, ns_spki: check sanity of public key #168

Merged
merged 2 commits into from
Nov 14, 2017
Merged

[Bug #14087] x509cert, x509crl, x509req, ns_spki: check sanity of public key #168

merged 2 commits into from
Nov 14, 2017

Commits on Nov 11, 2017

  1. pkey: make pkey_check_public_key() non-static 

    Also make it take const pointer as it never modifies the pkey.
    @rhenium
    rhenium committed Nov 11, 2017
    Configuration menu
    Copy the full SHA
    1425bf5 View commit details
    Browse the repository at this point in the history

Commits on Nov 13, 2017

  1. x509cert, x509crl, x509req, ns_spki: check sanity of public key 

    The pub_encode routine of an EVP_PKEY_ASN1_METHOD seems to assume the
parameters and public key component(s) to be set properly. Calling that,
for example, through X509_set_pubkey(), with an incomplete object may
cause segfault.

Use ossl_pkey_check_public_key() to check that. It doesn't look pretty,
but unfortunately there isn't a generic way to do that with the EVP API.

Something similar applies to the verify routine of an EVP_PKEY_METHOD.
Do the same check before calling *_verify().

Reference: http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/83688
Reference: https://bugs.ruby-lang.org/issues/14087
    @rhenium
    rhenium committed Nov 13, 2017
    Configuration menu
    Copy the full SHA
    363f40f View commit details
    Browse the repository at this point in the history